EtwpTrackProviderRegistration
VOID __fastcall EtwpTrackProviderRegistration(INT64 a1){
__int16 v1;
__int64 v3;
bool v4;
_ETW_SILODRIVERSTATE *v5;
int v6;
__int64 v7;
__int64 v8;
_WMI_LOGGER_CONTEXT *v9;
unsigned int *v10;
_WMI_LOGGER_CONTEXT *v11;
unsigned int *v12;
_WMI_LOGGER_CONTEXT *v13;
unsigned int *v14;
v1 = *(_WORD *)(a1 + 98);
v3 = *(_QWORD *)(a1 + 32);
v4 = (v1 & 1) == 0;
v5 = *(_ETW_SILODRIVERSTATE **)(v3 + 392);
if( (v1 & 8) != 0 )
{
if( (*(_BYTE *)(v3 + 91) & 1) != 0 )
{
v11 = EtwpAcquireLoggerContextByLoggerId(*(_ETW_SILODRIVERSTATE **)(v3 + 392), *(unsigned __int16 *)(v3 + 88), 0);
v12 = (unsigned int *)v11;
if( v11 )
{
EtwpProviderArrivalCallback(v11, v4, (_ETW_REG_ENTRY *)a1);
EtwpReleaseLoggerContext(v12, 0);
}
}
}
else
{
v6 = 1;
v7 = 0i64;
v8 = 8i64;
do
{
if( ((unsigned __int8)v6 & *(_BYTE *)(a1 + 100)) != 0 )
{
v9 = EtwpAcquireLoggerContextByLoggerId(v5, *(unsigned __int16 *)(v7 + v3 + 134), 0);
v10 = (unsigned int *)v9;
if( v9 )
{
if( (*(_BYTE *)(a1 + 98) & 0x20) != 0 || (*((_DWORD *)v9 + 208) & 0x2000000) != 0 )
EtwpProviderArrivalCallback(v9, v4, (_ETW_REG_ENTRY *)a1);
EtwpReleaseLoggerContext(v10, 0);
}
}
if( ((unsigned __int8)v6 & *(_BYTE *)(a1 + 102)) != 0 )
{
v13 = EtwpAcquireLoggerContextByLoggerId(
(_ETW_SILODRIVERSTATE *)EtwpHostSiloState,
*(unsigned __int16 *)(*(_QWORD *)(v3 + 400) + v7 + 134),
0);
v14 = (unsigned int *)v13;
if( v13 )
{
if( (*(_BYTE *)(a1 + 98) & 0x20) != 0 || (*((_DWORD *)v13 + 208) & 0x2000000) != 0 )
EtwpProviderArrivalCallback(v13, v4, (_ETW_REG_ENTRY *)a1);
EtwpReleaseLoggerContext(v14, 0);
}
}
v6 = __ROL4__(v6, 1);
v7 += 32i64;
--v8;
}
while( v8 );
}
}Referenced by:
EtwpRegisterProvider
EtwpRegisterUMGuid